Known Vulnerabilities for products from Concretecms
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Concretecms".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-8434 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMul... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8433 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan().... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8432 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). T... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8428 json | Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the ... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8427 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFav... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8426 json | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_re... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8421 json | Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_pag... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8417 json | Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8416 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavori... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8415 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/associa... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8414 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8413 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/desig... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8412 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cach... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8411 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delet... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8410 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delet... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8409 json | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete. ... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8350 json | Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privile... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8340 json | Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents permis... | Not Provided | 2026-05-22 | 2026-05-26 |
| CVE-2026-8337 json | Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such... | Not Provided | 2026-05-21 | 2026-05-26 |
| CVE-2026-8327 json | Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. Th... | Not Provided | 2026-05-21 | 2026-05-26 |